feat(kernel): v0.5.2 — hooks, self-test no CI, plugin manifest, regras reequilibradas e testes - #16
Conversation
|
Warning Review limit reached
Next review available in: 49 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (4)
📝 WalkthroughWalkthroughAdded the v0.5.2 Claude plugin manifest, security hooks, automated self-tests, expanded workflow metadata, pitch publication controls, WIZARD updates, and a generated self-hosted software catalog with supporting documentation and tests. ChangesSecurity and validation kernel
Wizard and workflow contracts
Self-hosted catalog pipeline
Estimated code review effort: 5 (Critical) | ~120 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 2📝 Generate docstrings 💡
🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Todas as 14 threads eram legítimas, e três apontavam erro factual meu: - README.md declarava uma ordem "autoritativa" de artefatos que estava errada: knowledge-base/ nasce na Onda 1, antes do BP, e faltavam os dois outputs de registry-pick. Agora a lista é agrupada por fase. - CLAUDE.md descrevia a Fase 3 parando em "três direções clicáveis", omitindo o DESIGN-DIRECTION.md — um agente lendo só aquela tabela entraria na Fase 4 sem criar a ponte que ela consome. - phase-4-documentacao.md tratava o mock data como schema honesto. Mock data mostra o que a UI renderiza e omite id, dono do registro, timestamps, papéis e auditoria. Virou ponto de partida, com tabela do que costuma faltar. Contradições internas corrigidas: - WIZARD.md dizia que os quatro campos do BP eram "a única especificação" da Fase 3, enquanto a doc da própria fase lista knowledge-base/ e as dez perguntas como inputs. Agora são o mínimo. - Sprint -1 foi criado no 4.4 mas o gate da Fase 5 só falava em Sprint 0/1, tornando-o inalcançável. A sequência -1 para 0 para 1 agora é explícita. - O comando registry-pick mandava ler PRODUCT-BRIEF e TECHNICAL-PLAN como sinais padrão; na passada 3.1 esses arquivos não existem. O contrato de input passou a ser declarado por passada. - phase-1-largada.md afirmava que todo usuário termina com repo desacoplado, mas o estágio 1.2 permite adiar com aviso. - A tabela de fallback das tags classificava docs/technical/ inteiro como DOCUMENTACAO, rotulando errado o registry-pick-design.md, que pertence à Fase 3.1. Lacunas fechadas: - prototype-lab/SKILL.md dizia "same mock data" sem nomear o arquivo. A Fase 4.2 deriva entidades dele, então precisa ser o mesmo arquivo. - A Fase 3 produz decisão durável e não exigia registro no session-log. - O template de DESIGN-DIRECTION permitia combinação de direções mas depois exigia prototype-lab/<chosen>/, inexistente para combinação. Agora pede identificador estável, pastas de origem e consolidação. - O mesmo template não tinha tabela de rejeitados. - MD040: três fences sem linguagem, dois deles encontrados por verificação própria depois que o CodeRabbit apontou o primeiro. Ressalva honesta no CHANGELOG: a convenção de tags está monotônica, mas o consumidor real (Grand Prix) vive no PR #9, que segue aberto. A inferência de progresso só para de andar pra trás quando o #9 mergear. Correções aplicadas no topo da pilha; chegam à main pelos PRs #12 a #16. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Seis skills não tinham frontmatter YAML nenhum, então a descrição que o
Claude via era o próprio título H1 ("Product Brief Skill"). Eram
justamente as seis que dirigem o WIZARD: project-genesis, research-waves,
business-plan-impact-review, product-brief, prototype-lab e
sprint-roadmap. As vinte periféricas do pack vibe-coder v0.3.0 já tinham
frontmatter completo — as mais antigas e centrais eram as invisíveis.
Pior caso: cinco arquivos vivos mandam invocar business-plan-impact-review
pelo nome, e a skill não conseguia se descrever.
Outras dez tinham frontmatter mas zero frase-gatilho. Descrição que diz o
que a skill faz não é a mesma coisa que dizer quando acioná-la.
frontmatter: 20/26 -> 26/26
gatilhos: 10/26 -> 26/26
Também corrigido:
- Três pares sobrepostos agora se referenciam nos dois sentidos
(secrets-discipline/secrets-scan, cost-watchdog/usage-monitor,
first-100-users/grow-sustainably). A assimetria era sempre na mesma
direção: a skill nova conhecia a antiga, nunca o contrário.
- release-check virou tabela de delegação em vez de checklist manual,
apontando verify-build-works, secrets-scan e privacy-audit. Fecha item
aberto desde 2026-05-01.
- docs/skill-system.md listava design-prototype e security-review, que
não existem. Substituído pelo inventário real.
Proveniência GitHub verificada, sem mudança necessária: 23 das 26 são
autorais deste repo; as 3 com upstream já linkam registry packs que
carregam as URLs.
Lacunas registradas e não corrigidas: não existe skill de technical-plan
(stage 4.2 roda só com prosa do WIZARD), e templates/project/CLAUDE.md
anuncia /release-check, que não existe.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
O OS não tinha artefato de Pitch nenhum. docs/business/ produzia só o BUSINESS-PLAN.md, e a palavra "pitch" aparecia apenas em registry packs descrevendo caso de uso de outras ferramentas. Colocar "BP e Pitch online" exigia inventar o Pitch primeiro. O novo estágio 2.9, no fim da Fase 2, faz duas coisas: 1. Escreve docs/business/PITCH.md — dez seções derivadas do BP v0.0.2. O pitch DERIVA e nunca ACRESCENTA: toda afirmação precisa já existir no BP. Se cabe no pitch mas falta no BP, o BP é que está incompleto. 2. Pergunta se BP e Pitch devem ficar online dentro do produto — como SUGESTÃO, não default, com três opções. "Nada online por enquanto" é resposta completa e encerra o estágio. Inserir o 2.9 renumerou ZERO estágios — primeiro teste da estrutura de fases entregue no PR 1, um commit depois. Gate de redação obrigatório antes de publicar qualquer coisa. Nunca vão ao ar sem aprovação explícita: projeções financeiras, unit economics, preço não anunciado, status de captação, registro interno de riscos, termos com fornecedores, teardown de concorrente e personas rastreáveis a entrevistado real. Três têm consequência além de vergonha: - Persona de entrevista real é dado pessoal (LGPD). Consentir em ser entrevistado não é consentir em ser publicado. - Teardown de concorrente convida retaliação jurídica e de imprensa. - Número publicado vira compromisso, cobrado depois em diligência. Também: - .claude/skills/pitch/SKILL.md — 27ª skill, pra que o estágio seja auto-invocável (a auditoria do PR 3 apontou estágio sem skill como defeito). - .claude/rules/privacy-audit.md ganha seção tratando publicação como forma de processamento, incluindo analytics na página pública, que reabre as nove perguntas. - Consequências roteadas pras fases donas: rotas no Product Brief (4.1), público-vs-gated e robots.txt no Technical Plan (4.2), analytics no privacy-audit, página como ativo de first-100-users/launch-agent. fix: a lista de artefatos do CLAUDE.md não tinha sido aplicada no PR 1 — o edit bateu no gate e a retentativa reaplicou outro edit. Corrigida aqui, com todos os artefatos na ordem de produção e sua fase. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…-self-hosted no 4.2
Importa a lista awesome-selfhosted (1.346 projetos) em três camadas e
acrescenta ao Technical Plan a pergunta sobre plataformas gerenciadas
versus self-hosted.
docs/selfhosted/shortlist-saas.md ~20 categorias que um SaaS de fato
substitui, curada à mão
docs/selfhosted/INDEX.md + catalog/ as 1.346 entradas, 95 tags upstream
colapsadas em 12 macro-categorias
docs/selfhosted/README.md carve-out de licença e trade-off
scripts/sync-selfhosted.js regenerador; nunca sobrescreve os
dois arquivos curados
docs/registry/packs/awesome-selfhosted.md one-pager pra descoberta
Licença: o OS é MIT, estes dados NÃO são. São CC-BY-SA 3.0 Unported,
share-alike, com autores creditados upstream. Atribuição carimbada em
todo arquivo gerado; fronteira documentada no README do diretório, no
ATTRIBUTIONS e no UPSTREAM-SOURCES.
A seção 7 do UPSTREAM-SOURCES manda evitar vendoring e preferir link. A
entrada nova declara a exceção e dá quatro razões: licença inequívoca,
link não serve ao estágio 4.2, a cópia é gerada e não bifurcada, e está
isolada num diretório só.
O estágio 4.2 apresenta três opções (gerenciado, self-hosted, híbrido)
com os dois lados, e traz instrução explícita de NÃO empurrar
self-hosted. "Gerenciado em tudo" costuma ser a resposta certa pra quem
está sozinho: self-hosted troca custo de fornecedor por custo de tempo e
operação — backup, uptime, patch e ser quem acorda às 3h.
Achado negativo, medido: nove tags upstream estão órfãs (o arquivo de
tag existe, zero projetos a referenciam) — Backup, Federated Identity,
Identity Management, Monitoring, CI/CD, FaaS, Static Site Generators,
VPN e Distributed Filesystems. Keycloak, MinIO, Supabase, Uptime Kuma,
Coolify, WireGuard, restic, Hugo e Jenkins estão ausentes do dataset. É
justamente auth, observabilidade, CI/CD, backup e PaaS. A shortlist
marca isso numa tabela de lacunas em vez de omitir.
Licenças medidas nas 1.346 entradas: MIT 360, AGPL-3.0 302, GPL-3.0 224,
Apache-2.0 143, BSD 51, Proprietary 70 — cerca de 39% copyleft. Seis
entradas da shortlist não são permissivas e levam aviso na própria
linha.
Dois bugs corrigidos durante o trabalho: o mapa de categorias usava
slugs de nome de arquivo (hífen duplo) contra nomes de exibição (hífen
simples), jogando 203 entradas em "Outros"; e as seções agrupavam por
tags[0], enterrando entradas cuja tag relevante não era a primeira.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
O PR 4 registrou que o awesome-selfhosted não cobre auth, uptime, CI/CD, backup, PaaS, site estático nem VPN. docs/selfhosted/gaps.md fecha isso com pesquisa própria: 90+ repositórios consultados na API do GitHub em 2026-08-08 — estrelas, licença, último push e status de arquivamento. Nenhum número escrito de memória. Diferente do resto de docs/selfhosted/, este arquivo é AUTORAL, não espelhado: MIT em vez de CC-BY-SA, e o sync-selfhosted.js não o toca. Cobre auth/SSO, uptime, CI/CD, backup, PaaS, site estático, VPN, BaaS e eventos, mais observabilidade, erros, segredos, object storage, feature flags, busca, workflow e infra de LLM. Cada categoria fecha com uma recomendação única — e no caso de CI/CD a recomendação é ficar no gerenciado. Achado principal: OPEN CORE é uma terceira armadilha de licença, além de copyleft e source-available. Treze projetos abrem o arquivo de licença com "Portions of this software are licensed as follows" — authentik, SuperTokens, Dokploy, Pangolin, SigNoz, Infisical, n8n, LiteLLM, Langfuse, GrowthBook, Meilisearch, Windmill e Duplicati. O núcleo é livre, mas SSO, RBAC e audit log ficam na edição paga. É a pior pro fundador: só aparece quando chega o primeiro cliente corporativo. Ler o arquivo de licença também corrigiu fatos que eu teria errado: Sentry é FSL-1.1 e não BUSL; Vault é BUSL-1.1, e é exatamente por isso que o OpenBao existe; Open WebUI tem licença própria "all rights reserved" apesar de 148k estrelas. Na direção oposta, CapRover, Astro, NetBird e Borg pareciam suspeitos como NOASSERTION mas são permissivos. Sobre o que o usuário citou: o Supabase de fato tem self-hosted próprio (Apache-2.0, 107.7k — o mais estrelado da pesquisa), com a ressalva de que o compose tem ~10 serviços. E NÃO existe clone do Luma: o que há cobre ticketing ou agendamento, não o calendário de comunidade. O mais próximo, Mobilizon, não vive no GitHub — está no framagit, então nunca apareceria numa busca por estrelas. Dois avisos incidentais: calcom/cal.com foi renomeado para calcom/cal.diy, e o Attendize está sem commits desde 2024-08 apesar de liderar a categoria em estrelas — motivo para estrela ranquear candidatos, não escolher. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Até aqui o OS era 100% persuasão: regras que o modelo lê, skills que ele invoca. O settings.json versionado tinha três linhas e nenhum hook. A golden rule nº 1 é "nunca commite segredos" e nada impedia isso mecanicamente — o CI só pega depois do push. Dois PreToolUse, ambos Node sem dependência: - block-secret-commit.js (matcher Bash) — inspeciona o diff staged em qualquer git commit. Bloqueia se alguma linha ADICIONADA tem formato de credencial, ou se um .env/.pem/.key foi staged. - protect-env-files.js (Write|Edit|MultiEdit|NotebookEdit) — impede o agente de escrever em .env real. .env.example é liberado. Os padrões exigem FORMATO COMPLETO, não prefixo. A regra secrets.md cita "sk-" e "AKIA" como texto literal; casar por prefixo bloquearia commitar a própria regra que define os padrões. Agora é sk- mais 20 caracteres, AKIA mais exatamente 16, ghp_ mais exatamente 36, e assim por diante. O hook nunca imprime o valor casado — só arquivo e nome do padrão. Um alerta que ecoa a credencial no terminal a espalha em vez de contê-la. Só linhas adicionadas são inspecionadas: remover uma chave vazada precisa continuar possível. Ambos falham ABERTO em payload malformado. Hook que trava a sessão por engano é pior que hook nenhum — o usuário desliga tudo e perde junto o que funcionava. Escape hatch por execução via AIOS_ALLOW_SECRET_COMMIT=1 e AIOS_ALLOW_ENV_WRITE=1, com instrução de registrar o porquê no session-log. Verificado ponta a ponta em repo git temporário: commit com chave é bloqueado nomeando arquivo e padrão sem vazar o valor, arquivo limpo passa, e 12/12 casos de caminho .env incluindo Windows. O README documenta também o que deliberadamente NÃO virou hook — forçar ordem do wizard, exigir changelog, bloquear push pra main. Regra de bolso: hook para o que é irreversível. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…gentes Mesmo defeito que o PR #12 corrigiu nas skills, uma camada abaixo — duas vezes. COMANDOS: 11 de 11 não tinham frontmatter nenhum. Começavam direto no "# /nome". Sem a chave description, a lista de slash commands sai crua e o usuário não sabe o que cada um faz sem abrir o arquivo. Agora todos têm description em português, e o /sprint-start ganhou argument-hint espelhando o formato que já estava documentado no corpo dele. AGENTES: 10 de 12 tinham descrição puramente declarativa — "Reviews business model, pricing, CAC" — que diz o que o agente faz e nunca quando acioná-lo. Só bug-triage-agent e launch-agent tinham gatilho, e não por acaso: são os dois nascidos no pack vibe-coder v0.3.0. A mesma fratura geracional das skills. comandos com frontmatter: 0/11 -> 11/11 agentes com gatilho: 2/12 -> 12/12 Casos que a auditoria destacou: - legal-compliance-agent é acionado por dez arquivos vivos (ETHOS, launch-agent, deploy-vercel-supabase, WIZARD 4.2, gaps.md, shortlist-saas, registry packs) e tinha zero gatilho. - competitor-research-agent e dev-product-agent são citados só por prosa no WIZARD ("Competitor Research Agent"), nunca pelo slug — vínculo mais fraco, agora compensado por descrição acionável. Nenhuma chave name: foi alterada, então toda referência existente por slug ou por caminho segue válida. Verificado: 23/23 frontmatter YAML parseável. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
A skill os-self-test existia pra validar coerência do OS, mas dependia de alguém lembrar de invocá-la — e três session-logs (2026-04-30, 2026-05-09, 2026-08-08) registram justamente ela NÃO sendo executada quando teria ajudado. Verificação que depende de memória não é verificação. scripts/os-self-test.js faz 8 grupos de checagem: estrutura canônica, frontmatter de skills/agents/commands, links relativos, integridade do registry (pack <-> INDEX nos dois sentidos), indexação do session-log, hooks declarados vs. presentes em disco, higiene do gitignore, e artefatos de projeto. Sai 0 coerente, 1 com erro. Dois modos, detectados pelo marcador .aios-self: no repo do OS os artefatos de projeto NÃO devem existir; num projeto derivado a ausência deles é aviso e não erro, porque o wizard pode não ter chegado na fase. Novo job "OS coherence" no CI, em paralelo ao lint-docs existente. Dois achados durante a implementação: - Falso positivo em ./rules. O check contava entradas de diretório, e o repo tem rules/quality e rules/stack-specific vazios e não versionados. Git não os vê, readdir sim — então falhava local e passava no CI. Agora conta arquivos recursivamente, o mesmo critério do checkout. - .claude/skills/external/ não tinha SKILL.md nem README. A regra agora é: diretório sob skills/ precisa de um dos dois, e a ausência dos dois indica skill quebrada. Como external/ é legitimamente diretório de referência, ganhou README declarando isso — e explicando por que o OS aponta pra skills de terceiros em vez de copiá-las. A skill virou wrapper: invoca o script e interpreta o resultado. Decidir se link quebrado significa arquivo faltando ou link sobrando continua sendo trabalho do modelo. Estado atual: 67 verificações passam, zero erro, zero aviso. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Não existia .claude-plugin/plugin.json, plugin.json, marketplace.json nem equivalente. Consequência: o OS só se distribuía por clone ou "Use this template" — sem instalação versionada, sem marketplace, sem caminho de atualização. O manifesto segue o schema dos plugins oficiais (conferido contra code-review, frontend-design e security-guidance): name, version, description, author, homepage, repository, license e keywords. Versão 0.5.2, coerente com a seção Unreleased do CHANGELOG. Dados do autor vindos do ATTRIBUTIONS.md, nada novo exposto. Isto era item de arquitetura anotado desde a auditoria da v0.5 e seguia aberto. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Tudo em .claude/rules/ entra em TODO prompt. A distribuição estava invertida: security-baseline tinha 3 linhas e wizard-stage-tags tinha 60 — 25% do orçamento inteiro para uma convenção opt-in. security-baseline 3 -> 42 linhas wizard-stage-tags 60 -> 19 linhas (ponteiro) TOTAL 236 -> 234 linhas O total quase não mudou. O ponto não era cortar, era gastar onde importa. security-baseline dizia "defina auth antes de features sensíveis" e parava aí. Agora é procedimento: 5 regras sempre válidas, checklist de 8 itens antes de expor ao público (incluindo o clássico de testar com dois usuários diferentes pra pegar IDOR), como integrar serviço externo, e a ordem certa quando algo vaza — rotacionar ANTES de investigar, porque tirar do commit não desfaz a exposição. O detalhe das stage tags foi para docs/wizard-stage-tags.md. Os 5 valores de tag não mudaram e o mapeamento 1:1 com as fases continua declarado na regra, então o Grand Prix e as outras 12 referências seguem válidos. Correção ao meu próprio relatório: eu tinha apontado três regras curtas como deficientes. Reexaminando, só security-baseline era. code-style e research-discipline são concisas mas completas — declaram o limite e o procedimento. Não foram infladas. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
O relatório apontou zero testes de qualquer tipo, com scripts reais já em produção — inclusive um parser YAML escrito à mão que tinha apresentado dois bugs descobertos só por conferência manual da saída. 75 testes em 11 suítes, com node:test. Zero dependências. Os testes acharam DOIS BYPASS REAIS no hook de segredo, ambos corrigidos aqui: 1. "git -C /tmp commit" não era reconhecido. O regex só tratava flags sem valor, e -C consome o próximo token. Quem usasse git -C passava direto pelo gate. 2. "git add . && git commit" também passava. Eu retornava no primeiro segmento do shell em vez de continuar procurando nos demais. isGitCommit deixou de ser regex e virou tokenização: separa por &&, ||, ; e |, pula flags (com lista explícita das que consomem valor) e checa se o primeiro token não-flag é "commit". Revalidado ponta a ponta em repo git temporário — os três vetores agora saem com exit 2. Cobertura: - block-secret-commit: 7 formatos de credencial; a documentação dos próprios padrões NÃO é bloqueada (a razão de existirem); só linhas adicionadas disparam; arquivos proibidos vs. .env.example; o achado nunca retém o valor casado; deduplicação; 15 formas de comando. - protect-env-files: 14 caminhos, incluindo Windows, sem depender de escaping do shell. - sync-selfhosted: slugifyTag, parseYaml com CRLF e mapas aninhados, e macroFor — este último cobrindo especificamente os dois bugs que vazaram no PR #14 (hífen duplo vs. simples, e agrupamento por tags[0] enterrando entradas). Todo segredo nos testes é sintético: formato válido, valor inventado. sync-selfhosted.js ganhou guarda require.main e passou a exportar as funções puras — sem isso, importá-lo num teste dispararia um git clone do upstream como efeito colateral. O step do CI usa glob e não diretório: node --test scripts/test/ faz o Node v24 resolver o caminho como módulo e falhar com Cannot find module. Verificado: 75/75 passam, os-self-test coerente, e o gerador reproduz o catálogo byte a byte (git diff vazio). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Registra as seis prioridades, as decisões que não são óbvias e os dois bypass que os testes acharam no próprio hook de segurança. Inclui correção a mim mesmo: o relatório apontou três regras curtas como deficientes; reexaminando, só security-baseline era. code-style e research-discipline são concisas mas completas, e não foram infladas só pra ficar consistente com o que eu tinha escrito antes. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Todas as 14 threads eram legítimas, e três apontavam erro factual meu: - README.md declarava uma ordem "autoritativa" de artefatos que estava errada: knowledge-base/ nasce na Onda 1, antes do BP, e faltavam os dois outputs de registry-pick. Agora a lista é agrupada por fase. - CLAUDE.md descrevia a Fase 3 parando em "três direções clicáveis", omitindo o DESIGN-DIRECTION.md — um agente lendo só aquela tabela entraria na Fase 4 sem criar a ponte que ela consome. - phase-4-documentacao.md tratava o mock data como schema honesto. Mock data mostra o que a UI renderiza e omite id, dono do registro, timestamps, papéis e auditoria. Virou ponto de partida, com tabela do que costuma faltar. Contradições internas corrigidas: - WIZARD.md dizia que os quatro campos do BP eram "a única especificação" da Fase 3, enquanto a doc da própria fase lista knowledge-base/ e as dez perguntas como inputs. Agora são o mínimo. - Sprint -1 foi criado no 4.4 mas o gate da Fase 5 só falava em Sprint 0/1, tornando-o inalcançável. A sequência -1 para 0 para 1 agora é explícita. - O comando registry-pick mandava ler PRODUCT-BRIEF e TECHNICAL-PLAN como sinais padrão; na passada 3.1 esses arquivos não existem. O contrato de input passou a ser declarado por passada. - phase-1-largada.md afirmava que todo usuário termina com repo desacoplado, mas o estágio 1.2 permite adiar com aviso. - A tabela de fallback das tags classificava docs/technical/ inteiro como DOCUMENTACAO, rotulando errado o registry-pick-design.md, que pertence à Fase 3.1. Lacunas fechadas: - prototype-lab/SKILL.md dizia "same mock data" sem nomear o arquivo. A Fase 4.2 deriva entidades dele, então precisa ser o mesmo arquivo. - A Fase 3 produz decisão durável e não exigia registro no session-log. - O template de DESIGN-DIRECTION permitia combinação de direções mas depois exigia prototype-lab/<chosen>/, inexistente para combinação. Agora pede identificador estável, pastas de origem e consolidação. - O mesmo template não tinha tabela de rejeitados. - MD040: três fences sem linguagem, dois deles encontrados por verificação própria depois que o CodeRabbit apontou o primeiro. Ressalva honesta no CHANGELOG: a convenção de tags está monotônica, mas o consumidor real (Grand Prix) vive no PR #9, que segue aberto. A inferência de progresso só para de andar pra trás quando o #9 mergear. Correções aplicadas no topo da pilha; chegam à main pelos PRs #12 a #16. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
8639080 to
81f8f45
Compare
O usuário perguntou se eu tinha lembrado do README. Parcialmente: eu atualizei só o que a reordenação de fases obrigava (Core flow, Prototype Lab, camadas de documentação, PITCH). Tudo que veio depois ficou de fora. Faltava: - badge travado em v0.4.5 - hooks: zero menções à única camada de enforcement do OS - docs/selfhosted/: zero menções aos 1.346 projetos e ao gaps.md - manifesto de plugin: zero menções, então ninguém sabia que dá pra instalar sem clonar - os-self-test.js e a suíte de testes: zero menções Adicionado: - Seção "Hooks — the kernel", explicando por que os padrões exigem formato completo e por que o hook nunca imprime o valor casado. - Seção do catálogo self-hosted, com o carve-out CC-BY-SA em destaque e as três armadilhas de licença. - Seção "The OS tests itself", com os dois comandos e a admissão de que os testes acharam dois bypass que o teste manual não pegou. - Nota de instalação como plugin no Quick start. - Skills: a lista de 9 exemplos virou tabela por estágio do wizard, com a contagem real de 27 e a regra de que descrição precisa dizer QUANDO acionar, não só o que faz. - Postura de segurança agora lidera com os hooks. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Duas falhas no primeiro run do CI novo, ambas legítimas: 1. Testes: "Could not find scripts/test/*.test.js". O glob entre aspas só funciona no Node 21+, que adicionou suporte a glob no --test; o runner usa Node 20 e recebeu a string literal. Meu Node 24 local mascarou o problema. Sem aspas, quem expande é o shell, e funciona em qualquer versão. 2. Lychee: 21 erros, todos em docs/selfhosted/catalog/. São os 1.346 links de terceiros que o PR anterior vendorizou — falham por TLS não confiável, HTTP/2 mal implementado e sites fora do ar. Não é defeito deste repo, e o upstream já roda o próprio verificador de link morto. Diretório excluído com --exclude-path, e a justificativa está no comentário do workflow pra ninguém "consertar" isso depois. As duas docs que ensinavam a forma com aspas (hooks/README e a skill os-self-test) foram corrigidas junto, mais o README. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Note
Due to the large number of review comments, Critical severity comments were prioritized as inline comments.
🟠 Major comments (28)
.claude/hooks/block-secret-commit.js-99-116 (1)
99-116: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winAdd newline to the segment separators; multiline commands bypass the hook.
Line 100 splits only on
&&,||,;, and|. The Bash tool commonly receives multiline commands. Ingit add .\ngit commit -m xthe whole text stays in one segment. Line 103 finds the firstgittoken, line 106 readsaddas the subcommand, and line 112 breaks. The commit is not detected, so the scan never runs.This is the same bypass class as the
git -Ccase already covered by the tests.🐛 Proposed fix
- const segments = String(command || '').split(/&&|\|\||;|\|/); + const segments = String(command || '').split(/&&|\|\||;|\||\r?\n/);Add a test case such as
'git add .\ngit commit -m y'to theisCommitlist inscripts/test/hooks.test.js.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/hooks/block-secret-commit.js around lines 99 - 116, Update isGitCommit to treat newline characters as command segment separators alongside &&, ||, ;, and |, so each multiline command is scanned independently and later git commit commands are detected. Add a corresponding multiline case such as git add followed by git commit to the isCommit cases in the hook tests..claude/hooks/block-secret-commit.js-39-40 (1)
39-40: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
FORBIDDEN_FILEandREAL_ENVdisagree on env variants.
FORBIDDEN_FILEmatches.env,.env.local,.env.production, and.env.<word>.localonly.REAL_ENVinprotect-env-files.jsmatches.env.<anything>except templates.The result:
protect-env-files.jsblocks writing.env.staging, butblock-secret-commit.jsallows staging and committing the same file. The two hooks must apply the same definition of a real env file.🐛 Proposed fix
-const FORBIDDEN_FILE = /(^|\/)\.env(\.local|\.production|\.[a-z]+\.local)?$|\.pem$|\.key$|\.p12$|\.pfx$/i; -const ALLOWED_FILE = /(^|\/)\.env\.(example|sample|template)$/i; +const FORBIDDEN_FILE = /(^|\/)\.env(\.[A-Za-z0-9_-]+)?$|\.pem$|\.key$|\.p12$|\.pfx$/i; +const ALLOWED_FILE = /(^|\/)\.env\.(example|sample|template|dist)$/i;Add
.env.stagingto the blocked list and.env.distto the allowed list inscripts/test/hooks.test.js.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/hooks/block-secret-commit.js around lines 39 - 40, Align FORBIDDEN_FILE with the REAL_ENV definition used by protect-env-files.js so all non-template .env variants, including .env.staging, are blocked; keep template/example/sample files allowed and add .env.dist to ALLOWED_FILE. Update the hook tests in hooks.test.js to cover both cases.docs/selfhosted/shortlist-saas.md-45-45 (1)
45-45: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winRemove the claim that self-hosting solves LGPD compliance.
Self-hosting can improve control over data location, but it does not establish lawful basis, transparency, retention, security, or controller/processor responsibilities. Replace “resolve LGPD de rastreamento de uma vez” with a scoped statement and point to
privacy-audit.As per coding guidelines, do not invent facts in regulatory claims.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/selfhosted/shortlist-saas.md` at line 45, Update the statement near “primeira troca” to remove the claim that self-hosting resolves LGPD compliance; replace it with a narrowly scoped benefit about data-location or infrastructure control, and link readers to the existing privacy-audit guidance for compliance considerations.Source: Coding guidelines
docs/selfhosted/catalog/observabilidade.md-1-5 (1)
1-5: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winMake generated category descriptions match actual coverage.
Both pages advertise categories that have no corresponding entries.
docs/selfhosted/catalog/observabilidade.md#L1-L5: remove or separately identify monitoring and status pages.docs/selfhosted/catalog/seguranca-identidade.md#L1-L5: remove or separately identify SSO and identity management.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/selfhosted/catalog/observabilidade.md` around lines 1 - 5, Update the category descriptions to match their actual entries: in docs/selfhosted/catalog/observabilidade.md lines 1-5, remove or separately identify monitoring and status pages; in docs/selfhosted/catalog/seguranca-identidade.md lines 1-5, remove or separately identify SSO and identity management. Keep the remaining descriptions aligned with the projects listed in each category.docs/selfhosted/gaps.md-132-134 (1)
132-134: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winCorrect the static-site license summary.
[docs/selfhosted/gaps.md:134] Zola is not in a permissive category: EUPL-1.2 has reciprocal/redistribution terms. Update this line to describe the license accurately or remove the “categoria inteiramente permissiva; nenhuma armadilha de licença aqui” claim.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/selfhosted/gaps.md` around lines 132 - 134, Update the Zola license note in the documentation to accurately characterize EUPL-1.2 as having reciprocal and redistribution obligations, or remove the claim that the category is entirely permissive and has no licensing pitfalls. Keep the existing distinction between static-site generation and hosting.Source: Coding guidelines
session-log/2026-08-08-v0.5.0-selfhosted-catalog.md-60-62 (1)
60-62: 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy liftAdd a reviewed non-exhaustive disclaimer to the licensing policy.
These license summaries are useful warnings, but they are not legal interpretation. Add one reviewed header/suffix before the tables and guidance with license-text links, then use it consistently in:
session-log/2026-08-08-v0.5.0-selfhosted-catalog.mdAGPL/Commons-Clause textdocs/selfhosted/gaps.mdcopyleft/source-available/open-core rowsdocs/selfhosted/shortlist-saas.mdn8n/AGPL sections🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@session-log/2026-08-08-v0.5.0-selfhosted-catalog.md` around lines 60 - 62, Add one reviewed, non-exhaustive licensing disclaimer before the tables and guidance, including links to the relevant license texts, and reuse it consistently in session-log/2026-08-08-v0.5.0-selfhosted-catalog.md lines 60-62 (anchor), docs/selfhosted/gaps.md lines 27-29, and docs/selfhosted/shortlist-saas.md lines 164 and 216-218. Apply the disclaimer to the AGPL and Commons-Clause discussion, copyleft/source-available/open-core rows, and n8n/AGPL sections without changing their substantive summaries.Source: Coding guidelines
docs/selfhosted/catalog/midia.md-106-106 (1)
106-106: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick winHandle generated catalogue links in CI.
These external URLs come from
awesome-selfhosted-dataand are rendered intodocs/selfhosted/. Makelychee-actionpolicy clear: allow known upstream rate limits/transients/timeouts, or replace/update stale links before regeneration. Do not patch generated Markdown manually.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/selfhosted/catalog/midia.md` at line 106, The generated catalogue links need CI handling through the lychee-action policy rather than manual Markdown edits: allow known upstream rate limits, transient failures, and timeouts, or update stale upstream URLs before regeneration. No direct changes are required at docs/selfhosted/catalog/midia.md:106, 178, 206, 213; docs/selfhosted/catalog/negocio.md:71, 76; docs/selfhosted/catalog/produtividade.md:63, 159, 186, 212, 304; or docs/selfhosted/catalog/outros.md:63, as they are generated output.Source: Pipeline failures
scripts/sync-selfhosted.js-199-207 (1)
199-207: 🩺 Stability & Availability | 🟠 Major | 🏗️ Heavy liftRestore a passing generated-link contract.
The generator uses
website_urlas the only rendered link. CI reports that the generated Traduora link at Line 90 returns HTTP 404. Update the upstream record or add a narrow documented source-link override, then regenerate the catalogue. Do not manually edit the generated file.
scripts/sync-selfhosted.js#L199-L207: support the approved fallback or override needed for dead project websites.docs/selfhosted/catalog/desenvolvimento.md#L90-L90: regenerate after the source link is corrected.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/sync-selfhosted.js` around lines 199 - 207, Update scripts/sync-selfhosted.js:199-207 in row(e) to use the approved narrow source-link fallback or documented override for dead project websites, including the Traduora record, while preserving normal website_url links. Regenerate docs/selfhosted/catalog/desenvolvimento.md:90-90 from the corrected upstream data; do not edit the generated catalogue manually.Source: Pipeline failures
docs/registry/INDEX.md-27-27 (1)
27-27: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winDo not classify this catalogue as an installable pack.
The master table is for repositories installed into a project.
docs/registry/packs/awesome-selfhosted.mdstates that this catalogue is already vendored and must never be a dependency. Move it to a separate vendored-reference section.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/registry/INDEX.md` at line 27, Move the awesome-selfhosted entry out of the installable-pack table in the registry index and into the separate vendored-reference section. Preserve its existing metadata and link, following the section’s established format; update only the classification and placement of this catalogue..claude/agents/legal-compliance-agent.md-3-3 (1)
3-3: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winAlign the data-collection gate with the invocation checklist.
Line 3 requires activation before collecting user data. The checklist shown in Lines 14-18 does not include general data collection. Add that trigger to the checklist, or narrow Line 3. Otherwise, first-party data collection can skip this review.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/agents/legal-compliance-agent.md at line 3, Align the activation criteria in the agent description with its invocation checklist: ensure the checklist explicitly includes activation before collecting any user data, matching the requirement stated in the description. Update the checklist section only and preserve the existing launch, payment, and other trigger conditions..claude/agents/business-red-team-agent.md-3-3 (1)
3-3: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winAdd evidence and uncertainty controls to both high-impact agents.
Both descriptions ask agents to produce business or compliance guidance without requiring sourced inputs, labeled assumptions, or explicit uncertainty.
.claude/agents/business-red-team-agent.md#L3-L3: require source-backed pricing, CAC, LTV, margin, and GTM inputs..claude/agents/technical-security-red-team-agent.md#L3-L3: require sourced regulatory claims and route legal interpretation tolegal-compliance-agent.As per coding guidelines: Do not invent facts in market, competitor, legal, pricing, or regulatory claims.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/agents/business-red-team-agent.md at line 3, Update the description for business-red-team-agent in .claude/agents/business-red-team-agent.md at line 3 to require source-backed pricing, CAC, LTV, margin, and GTM inputs, explicitly label assumptions and uncertainty, and avoid inventing market or financial claims. Update technical-security-red-team-agent in .claude/agents/technical-security-red-team-agent.md at line 3 to require sourced regulatory claims, explicitly label uncertainty, avoid invented legal or regulatory facts, and route legal interpretation to legal-compliance-agent.Source: Coding guidelines
.claude/agents/coordinator-agent.md-3-3 (1)
3-3: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winKeep the BP v0 человеческий approval gate explicit.
The coordinator currently “approves the deliverable,” but the wizard flow requires BP v0.0.1, human review, then BP v0.0.2. Add a requirement for an explicit human approval record before progression so AI approval does not replace human review.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/agents/coordinator-agent.md at line 3, The coordinator description must explicitly require a recorded human approval between BP v0.0.1 and BP v0.0.2, rather than allowing its AI approval to serve as the release gate. Update the coordinator-agent approval responsibility to preserve this ordering and require the human approval record before progression.Source: Coding guidelines
.claude/commands/bp-review.md-1-4 (1)
1-4: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winExija a aprovação humana antes da versão v0.0.2.
Line 2 permite gerar o BP v0.0.2 sem exigir um BP v0.0.1 aprovado e sem registrar a revisão humana. Adicione essa pré-condição e bloqueie a geração até que ela seja satisfeita.
As per coding guidelines, human review is mandatory for BP v0.0.1 before proceeding to BP v0.0.2.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/commands/bp-review.md around lines 1 - 4, Update the Business Plan workflow described by the frontmatter description to require a human-approved BP v0.0.1 before generating BP v0.0.2. Record the human review approval and block version generation when the prerequisite is missing or unapproved.Source: Coding guidelines
.claude/skills/verify-build-works/SKILL.md-3-3 (1)
3-3: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick winTorne o gatilho dependente do toolchain.
A descrição de execução ampla pode invocar esta skill em projetos sem comandos
npm. Como a escada começa comnpm run typecheckenpm run lint, o gatilho pode falhar antes de executar uma verificação válida e bloquearrelease-check. Restrinja a skill a projetos Node ou faça a execução detectar o runner e os scripts disponíveis.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/skills/verify-build-works/SKILL.md at line 3, Update the trigger description for the verify-build-works skill so it applies only to projects with a detected Node toolchain, or revise the execution flow to detect the project runner and available scripts before invoking commands such as typecheck and lint. Ensure release-check is not blocked when npm scripts are unavailable, while preserving the existing smoke-test behavior for supported projects..claude/skills/decision-log/SKILL.md-3-3 (1)
3-3: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winRequire session-log index maintenance.
The description allows a session-log entry but does not require updating
session-log/INDEX.mdand the session record. Add this requirement, or use an ADR when the session-log contract cannot be satisfied.As per coding guidelines, session-log changes must preserve decision memory, including the index and session records.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/skills/decision-log/SKILL.md at line 3, Update the decision-log skill description to require maintaining session-log/INDEX.md and the associated session record whenever a session-log entry is used; direct the workflow to use an ADR instead when the session-log contract cannot be satisfied.Source: Coding guidelines
.claude/commands/sprint-close.md-1-4 (1)
1-4: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winNarrow the sprint-close trigger.
"terminei essa etapa"can refer to a wizard phase or another task. This command updates the changelog and session records and prepares a merge/tag. Remove the broad trigger or require explicit confirmation of the active sprint before execution.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/commands/sprint-close.md around lines 1 - 4, Remove the broad “terminei essa etapa” trigger from the sprint-close command description, leaving only the explicit “fecha a sprint” trigger, or require confirmation that the active sprint is being closed before any changelog, session-log, merge, or tag actions execute..claude/skills/business-plan-impact-review/SKILL.md-1-5 (1)
1-5: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winMake the human approval gate explicit.
This metadata allows the skill to run while converting BP v0.0.1 into BP v0.0.2, but it does not require human review and approval before the transition. Add that prerequisite to prevent the impact check from replacing the required approval gate.
Proposed metadata change
-description: Check every Business Plan change for downstream impact before accepting it — price moves projections, ARPU, LTV and positioning; persona moves GTM, UX and MVP scope; stack moves costs, roadmap and risks. Runs at WIZARD stage 2.8 when turning BP v0.0.1 into v0.0.2, and any time the BP is edited after approval. +description: Check every Business Plan change for downstream impact before accepting it — price moves projections, ARPU, LTV and positioning; persona moves GTM, UX and MVP scope; stack moves costs, roadmap and risks. Runs at WIZARD stage 2.8 after human review and approval of BP v0.0.1, before turning it into v0.0.2, and any time the BP is edited after approval.As per coding guidelines, human review is mandatory for BP v0.0.1 before proceeding to BP v0.0.2.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/skills/business-plan-impact-review/SKILL.md around lines 1 - 5, Update the frontmatter metadata for the business-plan-impact-review skill to explicitly require human review and approval of BP v0.0.1 before transitioning to BP v0.0.2. Preserve the existing impact-check triggers and stage information while adding this approval prerequisite.Source: Coding guidelines
WIZARD.md-608-618 (1)
608-618: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winKeep the Phase 5 contract consistent.
Lines 610-618 make Sprint -1 mandatory, but the phase map at Lines 21-27 still says that Phase 5 produces only Sprint 0 and Sprint 1. Update the phase map or explicitly include Sprint -1 in its Phase 5 output.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@WIZARD.md` around lines 608 - 618, Update the Phase 5 phase-map entry near the documented phase outputs to include mandatory Sprint -1 alongside Sprint 0 and Sprint 1, keeping it consistent with the sprint sequence and implementation contract described in the Sprint section..claude/skills/pitch/SKILL.md-62-68 (1)
62-68: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winUse risk-based privacy wording in both publication gates.
Both documents state that an identifiable persona example “is an LGPD problem”. The legal result depends on the facts and review outcome. State that the example may create a privacy risk and require
privacy-audit.
.claude/skills/pitch/SKILL.md#L62-L68: replace the definitive LGPD conclusion with qualified privacy-risk wording.WIZARD.md#L361-L365: apply the same qualified wording in the canonical wizard.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/skills/pitch/SKILL.md around lines 62 - 68, Qualify the persona privacy statement in both publication gates: in .claude/skills/pitch/SKILL.md lines 62-68 and WIZARD.md lines 361-365, replace the definitive LGPD conclusion with wording that an identifiable real-interview persona may create a privacy risk, while retaining the requirement to invoke privacy-audit before publication.Source: Coding guidelines
.claude/skills/pitch/SKILL.md-88-95 (1)
88-95: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winKeep all session-log records indexed.
Both workflow contracts create a session record but omit the required
session-log/INDEX.mdupdate.
.claude/skills/pitch/SKILL.md#L88-L95: addsession-log/INDEX.mdto the pitch output and maintenance steps.WIZARD.md#L378-L385: require the publication-decision record to be added tosession-log/INDEX.md.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/skills/pitch/SKILL.md around lines 88 - 95, The pitch workflow contract in .claude/skills/pitch/SKILL.md, including its Outputs and maintenance steps, must include updating session-log/INDEX.md whenever the session-log record is created. Update the publication-decision workflow in WIZARD.md (lines 378-385) to likewise require indexing the record in session-log/INDEX.md.Source: Coding guidelines
.claude/skills/privacy-audit/SKILL.md-3-3 (1)
3-3: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winExpose all nine privacy-audit outputs.
Line 3 promises explicit review of logs, deletion/export, and policy impact. The output template at Lines 19-27 has no fields for these areas. Add fields for
Logs,Deletion/export, andPolicy impactbeforeVerdict.Proposed output fields
Retention: +Logs: +Deletion/export: +Policy impact: Risks: Required changes before merge: Verdict: PASS | PASS_WITH_NOTES | BLOCK🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/skills/privacy-audit/SKILL.md at line 3, Update the privacy-audit output template to expose the missing Logs, Deletion/export, and Policy impact fields before Verdict, matching the nine review questions promised in the description. Preserve the existing fields and ordering, and ensure each new field is explicitly represented in the template.docs/wizard/phase-2-ideacao.md-60-72 (1)
60-72: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winKeep all durable workflow decisions indexed.
The phase documents require durable decisions, but they do not consistently require updating
session-log/INDEX.md.
docs/wizard/phase-2-ideacao.md#L60-L72: require a dated publication-decision record and its index entry before Phase 3.docs/wizard/phase-3-prototipo.md#L66-L67: require the design-decision record and its index entry.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/wizard/phase-2-ideacao.md` around lines 60 - 72, Update docs/wizard/phase-2-ideacao.md lines 60-72 to require a dated publication-decision record and its corresponding session-log/INDEX.md entry before Phase 3. Update docs/wizard/phase-3-prototipo.md lines 66-67 to require both the design-decision record and its session-log/INDEX.md entry, keeping all durable workflow decisions indexed.Source: Coding guidelines
docs/wizard/phase-2-ideacao.md-72-78 (1)
72-78: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winMake the public option compatible with the redaction gate.
Line 72 offers “everything public”. Lines 78-84 then require redaction and list content that must not be published. A literal full-public option cannot satisfy both rules. Rename it to a redacted public version or define the exclusions.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/wizard/phase-2-ideacao.md` around lines 72 - 78, Update the three-option description and the “redaction gate” section so the public option explicitly means a redacted public version, or clearly defines the mandatory exclusions. Ensure “everything public” cannot imply publishing protected content such as financial projections, unit economics, fundraising status, the internal risk register, or supplier terms.docs/wizard/phase-2-ideacao.md-82-82 (1)
82-82: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winSubstantiate or replace the unconditional LGPD claim.
LGPD appliesis a broad legal conclusion. If the project may be outside LGPD scope, replace it with a review trigger, such as “If LGPD may apply, runprivacy-auditbefore publishing any persona.”🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/wizard/phase-2-ideacao.md` at line 82, Revise the persona privacy guidance near the “Personas from real interviews” statement to avoid asserting unconditionally that LGPD applies; make running `privacy-audit` conditional on LGPD potentially applying, while preserving the requirement to audit before publishing when that condition is met.Source: Coding guidelines
docs/wizard/phase-2-ideacao.md-86-90 (1)
86-90: 🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy liftClose the Technical Plan execution gap.
Phase 2 makes Technical Plan ownership a required gate for public or gated publication, but Stage 4.2 is still prose-only and no
technical-planskill exists. Add an executable skill or command, or define the manual procedure and owner before requiring this path.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/wizard/phase-2-ideacao.md` around lines 86 - 90, Update the Phase 2 “It becomes product surface” guidance to provide an executable technical-plan skill or command, or explicitly define the manual procedure and responsible owner, before making Technical Plan ownership a required publication gate. Ensure the referenced Stage 4.2 workflow is actionable rather than prose-only.templates/product/DESIGN-DIRECTION.template.md-10-20 (1)
10-20: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winUse the stable combination identifier as the Phase 4 path.
The field on Line [10] permits literal
combination, but Phase 4 resolvesprototype-lab/<chosen>/. The stable identifier is stored separately in the table. If<chosen>remainscombination, the handoff points to an ambiguous path. Require<chosen>to equal the stable combination identifier, and update the stage precondition to allow an approved combination.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@templates/product/DESIGN-DIRECTION.template.md` around lines 10 - 20, The “Chosen direction” field must use the stable combination identifier rather than the literal “combination” when a combination is selected. Update the field guidance and Phase 4 precondition so approved combinations are allowed only when the identifier matches the consolidated folder under prototype-lab/<chosen>/.templates/business/PITCH.template.md-65-69 (1)
65-69: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winApply the redaction gate to every publication mode.
Line [11] allows
gated, and the table includes aGated (login / secret link)column. However, Line [67] limits the gate to a public URL. A gated page still discloses personal data, pricing, metrics, or team details. Require the gate for login-protected and secret-link delivery too.Proposed wording
- Fill this in **only** if the pitch or the BP is going to a public URL. + Fill this in **whenever** the pitch or the BP will be published, including a public URL, login-protected page, or secret link.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@templates/business/PITCH.template.md` around lines 65 - 69, The Redaction gate instructions in the pitch template currently limit completion to public URLs; update that section to require the gate for every publication mode, including gated login-protected and secret-link delivery. Keep the existing table and publication approval purpose intact while removing the public-only restriction.CLAUDE.md-28-36 (1)
28-36: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winAdd both registry-pick artifacts to the required artifact contract.
The wizard output order in
README.mdincludesdocs/technical/registry-pick-design.mdin Phase 3 anddocs/technical/registry-pick.mdin Phase 4. This list omits both files. A project can therefore satisfyCLAUDE.mdwhile skipping required registry decisions.Proposed additions
knowledge-base/README.md (Phase 2) docs/business/BUSINESS-PLAN.md (Phase 2) docs/business/PITCH.md (Phase 2) +docs/technical/registry-pick-design.md (Phase 3) prototype-lab/README.md (Phase 3) docs/product/DESIGN-DIRECTION.md (Phase 3) docs/product/PRODUCT-BRIEF.md (Phase 4) docs/technical/TECHNICAL-PLAN.md (Phase 4) +docs/technical/registry-pick.md (Phase 4) docs/SPRINTS.md (Phase 4)🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@CLAUDE.md` around lines 28 - 36, Update the required artifact contract in CLAUDE.md to include both docs/technical/registry-pick-design.md and docs/technical/registry-pick.md, preserving their Phase 3 and Phase 4 classifications and the existing artifact order.
🟡 Minor comments (14)
scripts/test/hooks.test.js-5-5 (1)
5-5: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winCorrect the run command in the header.
Line 5 documents
node --test scripts/test/..claude/hooks/README.mdline 76 and.github/workflows/ci.ymlline 30 both state that the directory form fails on Node v24 and that the glob is required. Use the same command in all three places.📝 Proposed fix
- * Run: node --test scripts/test/ + * Run: node --test "scripts/test/*.test.js"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/test/hooks.test.js` at line 5, Update the header run command in scripts/test/hooks.test.js to use the required test-file glob instead of the scripts/test/ directory form, matching the command documented in .claude/hooks/README.md and .github/workflows/ci.yml..claude/hooks/README.md-51-54 (1)
51-54: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winMake the second escape-hatch example runnable.
Line 52 shows the variable with a command. Line 53 shows only an assignment. An assignment alone does not export the variable to the hook process, so the example does not work as written.
📝 Proposed fix
AIOS_ALLOW_SECRET_COMMIT=1 git commit -m "fixture de teste com token falso" -AIOS_ALLOW_ENV_WRITE=1 +AIOS_ALLOW_ENV_WRITE=1 claude # ou: export AIOS_ALLOW_ENV_WRITE=1 na sessão🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/hooks/README.md around lines 51 - 54, Update the second escape-hatch example in the README to export AIOS_ALLOW_ENV_WRITE so the variable is available to the hook process, matching the runnable pattern used by the AIOS_ALLOW_SECRET_COMMIT example..claude/hooks/block-secret-commit.js-133-137 (1)
133-137: 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
git commit --alldoes not enable the unstaged scan.The regex on line 134 requires
-followed by optional letters and thena. For--allthe second-breaks the match, soincludeUnstagedstays false.git commit --allstages tracked modifications at commit time, and those lines are then never scanned.🐛 Proposed fix
- const includeUnstaged = /\bcommit\b[^&|;]*\s-[a-zA-Z]*a/.test(command); + const includeUnstaged = /\bcommit\b[^&|;]*\s(?:--all\b|-[a-zA-Z]*a)/.test(command);🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/hooks/block-secret-commit.js around lines 133 - 137, Update the includeUnstaged detection near the commit command parsing to recognize both short all-staging options such as -a and the long --all form, while preserving existing command-boundary handling. Ensure git commit --all causes the unstaged diff to be included in the scan.docs/selfhosted/gaps.md-84-84 (1)
84-84: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winReplace unsupported cost rules with evidence-based criteria.
These locations present cost or pricing conclusions without assumptions or sources.
docs/selfhosted/gaps.md#L84-L84: qualify the managed-CI and self-hosted-maintenance claim.docs/selfhosted/gaps.md#L117-L117: qualify the Coolify cost claim.docs/selfhosted/shortlist-saas.md#L226-L226: remove or substantiate the R$200/month threshold.As per coding guidelines, do not invent facts in pricing or market claims.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/selfhosted/gaps.md` at line 84, Replace unsupported pricing and cost conclusions at docs/selfhosted/gaps.md:84-84 and docs/selfhosted/gaps.md:117-117 with qualified, assumption-based statements or add reliable sources; do not present managed-CI, self-hosted maintenance, or Coolify cost claims as universal facts. At docs/selfhosted/shortlist-saas.md:226-226, remove the unsupported R$200/month threshold or substantiate it with an appropriate source and clearly stated assumptions.Source: Coding guidelines
scripts/sync-selfhosted.js-47-50 (1)
47-50: 🩺 Stability & Availability | 🟡 Minor | ⚡ Quick winRemove temporary upstream clones after generation.
Each no-argument run creates
ash-data-*under the system temp directory.main()exits without deleting it. Track whetherresolveDataDir()created the clone, then remove it in afinallyblock afterrender()completes.Also applies to: 259-266
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/sync-selfhosted.js` around lines 47 - 50, Update resolveDataDir() to indicate whether it created the temporary upstream clone, then have main() remove that clone in a finally block after render() completes. Preserve cleanup only for clones created by the no-argument path, leaving user-provided data directories untouched.scripts/sync-selfhosted.js-233-235 (1)
233-235: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winDo not describe the full catalogue as open source.
The supplied documentation states that 70 entries are proprietary. Use “self-hosted software projects” for the full dataset. Keep “open source” only for entries whose license supports that classification.
scripts/sync-selfhosted.js#L233-L235: generate neutral catalogue wording, then regeneratedocs/selfhosted/INDEX.md.docs/selfhosted/INDEX.md#L3-L3: update through the generator output.docs/selfhosted/README.md#L3-L3: update the manual introduction.docs/registry/packs/awesome-selfhosted.md#L13-L13: update the pack description.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/sync-selfhosted.js` around lines 233 - 235, Update the catalogue wording generated by scripts/sync-selfhosted.js:233-235 to describe the full dataset as self-hosted software projects, reserving “open source” for qualifying entries, then regenerate docs/selfhosted/INDEX.md:3-3. Also update the manual descriptions in docs/selfhosted/README.md:3-3 and docs/registry/packs/awesome-selfhosted.md:13-13 to use the same neutral wording.Source: Coding guidelines
docs/selfhosted/README.md-69-71 (1)
69-71: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winLimit the coverage warning to the empty upstream tags.
The catalogue still contains 91 entries in “Arquivos e backup” and 48 in “Observabilidade e busca.” State that the specific
BackupandMonitoring & Status Pagestags are empty instead of saying that the catalogue does not help with backup or observability.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/selfhosted/README.md` around lines 69 - 71, Revise the “Consequência prática” statement to limit the coverage warning to the empty upstream tags, specifically `Backup` and `Monitoring & Status Pages`. Do not claim that the mirrored catalogue lacks backup or observability coverage, since those categories still contain entries; preserve the separate `gaps.md` explanation for the independently researched categories..claude/rules/privacy-audit.md-16-27 (1)
16-27: 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick winEspecifique o regime jurídico aplicável.
As regras das linhas 23–25 tratam nomes, photos, analytics e irrevogabilidade efetiva como fatos universais. Use LGPD/GDPR ou “legislação aplicável” quando citar esses controles; mantenha linguagem conservadora, como “tratamento de dados potencialmente identificador”.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/rules/privacy-audit.md around lines 16 - 27, Update the publication checklist in the section describing personal-data controls to reference LGPD/GDPR or applicable legislation, rather than presenting names, photos, analytics, and practical irreversibility as universal legal facts. Use conservative wording such as “potentially identifying data processing,” while preserving the existing consent, analytics, and permanence checks.Source: Coding guidelines
docs/wizard-stage-tags.md-38-40 (1)
38-40: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winDo not claim that tag order is enforced.
The convention is opt-in and has no lint or gate. Users can still create out-of-order tags. Replace “sempre” with “a ordem esperada” or state that the order is canonical but not enforced.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/wizard-stage-tags.md` around lines 38 - 40, Update the documentation text near the tag-order statement to remove the claim that the five tags always appear in the table’s order; describe the order as expected or canonical but not enforced, while preserving the note that the tag values themselves are unchanged.docs/wizard-stage-tags.md-44-53 (1)
44-53: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winDocument the
LARGADAfallback.The fallback table covers IDEACAO, PROTOTIPO, DOCUMENTACAO, and CHEGADA, but it has no
LARGADArow. The repository defines five phase/tag pairs indocs/wizard/README.md, so a phase-1 commit has no documented inference path. Add the canonical phase-1 paths or state that LARGADA requires an explicit tag.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/wizard-stage-tags.md` around lines 44 - 53, Update the fallback inference table in the documentation to cover the LARGADA phase, matching the canonical phase-1 paths defined in docs/wizard/README.md; if no reliable paths exist, explicitly state that LARGADA requires an explicit tag. Preserve the existing rule ordering, including the specific registry-pick-design.md rule before the generic technical-documents rule.WIZARD.md-540-540 (1)
540-540: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winPoint the catalogue link to the indexed catalogue.
Line 540 labels
docs/selfhosted/INDEX.mdbut links todocs/selfhosted/README.md. Link todocs/selfhosted/INDEX.md, or change the label and description to match the README.Proposed link correction
-| [`docs/selfhosted/INDEX.md`](docs/selfhosted/README.md) | the full 1.346-project catalogue | +| [`docs/selfhosted/INDEX.md`](docs/selfhosted/INDEX.md) | the full 1.346-project catalogue |🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@WIZARD.md` at line 540, Update the catalogue entry in WIZARD.md so the displayed path and hyperlink target both reference docs/selfhosted/INDEX.md, while preserving the existing description.docs/wizard/phase-3-prototipo.md-66-67 (1)
66-67: 🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick winKeep the session-log index synchronized.
The text requires a decision record but does not require the matching
session-log/INDEX.mdentry. Add that index update to the Phase 3 output.As per coding guidelines:
session-log/**/*.mdmust preserve decision memory and maintain its index and session records.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/wizard/phase-3-prototipo.md` around lines 66 - 67, Atualize a seção de saídas da Fase 3 em “phase-3-prototipo.md” para exigir, além do registro da decisão em “session-log/”, a inclusão da entrada correspondente em “session-log/INDEX.md”, mantendo o índice sincronizado com o registro criado.Source: Coding guidelines
README.md-279-279 (1)
279-279: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winUse one
os-self-testverification count.Line [279] says 8 coherence checks, while the release notes report 67 verifications. If 8 is the number of top-level suites, label it as such. Otherwise, update the command comment to 67 verifications.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@README.md` at line 279, Update the inline comment for the os-self-test command to use a single accurate verification count: label 8 explicitly as top-level suites if that is what it represents; otherwise change it to 67 verifications to match the release notes.docs/skill-audit-2026-08-08.md-3-3 (1)
3-3: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winReconcile the pre-
pitchaudit with the v0.5.2 27-skill inventory.These records mix a pre-
pitchcount of 26 with the final inventory that includespitchas skill 27. Update current-state claims to 27/27, or label the 26-skill material as a historical snapshot.
docs/skill-audit-2026-08-08.md#L3-L3: update the audit scope and repeated 26-skill metrics, or label the audit pre-pitch.CHANGELOG.md#L189-L194: update the current frontmatter and trigger metrics to 27/27, or scope them to the pre-pitchaudit.CHANGELOG.md#L210-L214: update the description of the audit and inventory from 26 to 27, or identify the historical scope.session-log/2026-08-08-v0.5.0-skills-audit.md#L1-L3: label the record as a pre-pitchaudit if the historical count is intentional.session-log/2026-08-08-v0.5.0-skills-audit.md#L47-L50: update final-state verification to 27/27, or state that it covers only the pre-pitchset.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/skill-audit-2026-08-08.md` at line 3, Reconcile the pre-pitch 26-skill references with the v0.5.2 inventory: in docs/skill-audit-2026-08-08.md lines 3-3, CHANGELOG.md lines 189-194 and 210-214, and session-log/2026-08-08-v0.5.0-skills-audit.md lines 1-3 and 47-50, either update current-state counts and verification to 27/27 including pitch or explicitly label each 26-skill record and metric as covering the historical pre-pitch audit.
🧹 Nitpick comments (4)
.github/workflows/ci.yml (1)
10-30: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winRestrict the workflow token for the new job.
The
os-self-testjob declares nopermissions:block, so it inherits the default token scope. The job only reads the repository. Set read-only permissions and stop credential persistence in the checkout.🔒️ Proposed fix
os-self-test: runs-on: ubuntu-latest name: OS coherence + permissions: + contents: read steps: - uses: actions/checkout@v4 + with: + persist-credentials: falseApply the same
permissions:block tolint-docs, or declare a top-levelpermissions: contents: readfor the workflow.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yml around lines 10 - 30, Add read-only contents permissions to the os-self-test job and disable credential persistence in its actions/checkout step. Apply the same permissions configuration to lint-docs, or define contents: read at workflow scope, while preserving the existing test steps.Source: Linters/SAST tools
scripts/test/hooks.test.js (1)
26-43: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAdd a case for the GitHub fine-grained token pattern.
PATTERNSdeclares eight patterns. Thecaseslist covers seven.github_pat_has no positive case, so a regression in that regex passes the suite.♻️ Proposed addition
['GitHub PAT', 'TOKEN=ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789'], + ['GitHub fine-grained', 'TOKEN=github_pat_' + 'A'.repeat(22) + '_' + 'B'.repeat(30)], ['AWS', 'aws_access_key_id = AKIAIOSFODNN7EXAMPLE'],🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/test/hooks.test.js` around lines 26 - 43, Add a positive test case to the cases array in the block-secret-commit test for the GitHub fine-grained token pattern using the github_pat_ prefix, so PATTERNS coverage includes all declared credential patterns. Keep the existing assertions and test structure unchanged.scripts/os-self-test.js (1)
124-136: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAgents with no
namekey are not reported.Line 132 checks the
namevalue only whenfm.nameis set. Foragents,needsNameistrue, but a file with nonamekey passes silently. Skills apply the stricter rule at line 116. Apply the same rule to agents.♻️ Proposed fix
- if (needsName && fm.name && fm.name !== slug) fail(dir, `${slug} declara name: ${fm.name}`); + if (needsName && !fm.name) fail(dir, `${slug} sem chave name:`); + else if (needsName && fm.name !== slug) fail(dir, `${slug} declara name: ${fm.name}`);🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/os-self-test.js` around lines 124 - 136, Update the agent validation branch in the loop over `.claude/${dir}` so `needsName` requires `fm.name` to be present and equal to the file slug; report missing names with `fail` just as skills do, while preserving the existing mismatch validation for declared names and the command behavior.session-log/2026-08-08-v0.5.0-selfhosted-catalog.md (1)
80-88: 🗄️ Data Integrity & Integration | 🔵 Trivial | 🏗️ Heavy liftRecord one reproducible upstream snapshot.
The session record and source map describe exact generated data but do not identify the upstream commit used to produce it.
session-log/2026-08-08-v0.5.0-selfhosted-catalog.md#L80-L88: record the upstream commit and generation date with the measured counts.UPSTREAM-SOURCES.md#L119-L129: document the pinned revision or stamp it into generated catalog metadata.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@session-log/2026-08-08-v0.5.0-selfhosted-catalog.md` around lines 80 - 88, Record the exact upstream commit used for generation and the generation date alongside the measured counts in session-log/2026-08-08-v0.5.0-selfhosted-catalog.md lines 80-88. Document the same pinned revision in UPSTREAM-SOURCES.md lines 119-129, or stamp it into the generated catalogue metadata; ensure both locations identify one reproducible upstream snapshot.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 156c35f4-980f-4cd7-8489-15c54e4f08d4
📒 Files selected for processing (96)
.claude-plugin/plugin.json.claude/agents/business-red-team-agent.md.claude/agents/competitor-research-agent.md.claude/agents/coordinator-agent.md.claude/agents/copywriter-agent.md.claude/agents/dev-product-agent.md.claude/agents/devils-advocate-agent.md.claude/agents/legal-compliance-agent.md.claude/agents/market-research-agent.md.claude/agents/research-agent.md.claude/agents/technical-security-red-team-agent.md.claude/commands/bp-review.md.claude/commands/grow-sustainably.md.claude/commands/multi-ai-review.md.claude/commands/processize.md.claude/commands/project-start.md.claude/commands/prototype-lab.md.claude/commands/registry-pick.md.claude/commands/research-waves.md.claude/commands/sprint-close.md.claude/commands/sprint-plan.md.claude/commands/sprint-start.md.claude/hooks/README.md.claude/hooks/block-secret-commit.js.claude/hooks/protect-env-files.js.claude/rules/documentation-layers.md.claude/rules/privacy-audit.md.claude/rules/security-baseline.md.claude/rules/wizard-stage-tags.md.claude/settings.example.json.claude/settings.json.claude/skills/business-plan-impact-review/SKILL.md.claude/skills/cost-watchdog/SKILL.md.claude/skills/decision-log/SKILL.md.claude/skills/external/README.md.claude/skills/feature-scaffold/SKILL.md.claude/skills/first-100-users/SKILL.md.claude/skills/os-self-test/SKILL.md.claude/skills/pitch/SKILL.md.claude/skills/privacy-audit/SKILL.md.claude/skills/product-brief/SKILL.md.claude/skills/project-genesis/SKILL.md.claude/skills/prototype-lab/SKILL.md.claude/skills/release-check/SKILL.md.claude/skills/research-waves/SKILL.md.claude/skills/secrets-discipline/SKILL.md.claude/skills/secrets-scan/SKILL.md.claude/skills/sprint-management/SKILL.md.claude/skills/sprint-roadmap/SKILL.md.claude/skills/verify-build-works/SKILL.md.github/workflows/ci.ymlATTRIBUTIONS.mdCHANGELOG.mdCLAUDE.mdREADME.mdUPSTREAM-SOURCES.mdWIZARD.mddocs/documentation-layers.mddocs/registry/INDEX.mddocs/registry/packs/awesome-selfhosted.mddocs/selfhosted/INDEX.mddocs/selfhosted/README.mddocs/selfhosted/catalog/arquivos-backup.mddocs/selfhosted/catalog/automacao-ia.mddocs/selfhosted/catalog/comunicacao.mddocs/selfhosted/catalog/conteudo.mddocs/selfhosted/catalog/desenvolvimento.mddocs/selfhosted/catalog/infraestrutura.mddocs/selfhosted/catalog/midia.mddocs/selfhosted/catalog/negocio.mddocs/selfhosted/catalog/observabilidade.mddocs/selfhosted/catalog/outros.mddocs/selfhosted/catalog/produtividade.mddocs/selfhosted/catalog/seguranca-identidade.mddocs/selfhosted/gaps.mddocs/selfhosted/shortlist-saas.mddocs/skill-audit-2026-08-08.mddocs/skill-system.mddocs/wizard-stage-tags.mddocs/wizard/phase-1-largada.mddocs/wizard/phase-2-ideacao.mddocs/wizard/phase-3-prototipo.mddocs/wizard/phase-4-documentacao.mdscripts/os-self-test.jsscripts/sync-selfhosted.jsscripts/test/hooks.test.jsscripts/test/sync-selfhosted.test.jssession-log/2026-08-08-v0.5.0-pitch-publication.mdsession-log/2026-08-08-v0.5.0-selfhosted-catalog.mdsession-log/2026-08-08-v0.5.0-skills-audit.mdsession-log/2026-08-08-v0.5.0-wizard-5-phases.mdsession-log/2026-08-08-v0.5.1-selfhosted-gaps.mdsession-log/2026-08-08-v0.5.2-kernel.mdsession-log/INDEX.mdtemplates/business/PITCH.template.mdtemplates/product/DESIGN-DIRECTION.template.md
1 participant
Implementa as 6 prioridades do relatório de avaliação, em 6 commits separados para o review ficar navegável.
O diagnóstico era: "você construiu um sistema operacional muito bem documentado que não tem kernel". Este PR é o kernel.
P1 — Hooks 🔑
O
settings.jsonversionado tinha três linhas. Zero hooks. A golden rule nº 1 é "nunca commite segredos" e nada impedia isso mecanicamente — o CI só pega depois do push.block-secret-commit.jsBash→git commit.env/.pem/.keystagedprotect-env-files.jsWrite/Edit/MultiEdit/NotebookEdit.envrealFormato completo, não prefixo.
secrets.mdcitask-eAKIAcomo texto literal — casar por prefixo bloquearia commitar a própria regra que os define. Agora ésk-+ 20 caracteres,AKIA+ exatamente 16,ghp_+ exatamente 36.Três decisões que não são óbvias:
O README documenta o que não virou hook (forçar wizard, exigir changelog, bloquear push). Regra: hook para o que é irreversível.
P2 — Frontmatter
Os dois que já tinham nasceram no pack v0.3.0 — mesma fratura geracional das skills.
legal-compliance-agenté acionado por 10 arquivos vivos e tinha zero.P3 —
os-self-testvira scriptEra skill, dependia de memória — e três session-logs registram ela não sendo executada quando teria ajudado.
Agora: 8 grupos de checagem, job no CI, 67 verificações e zero erro. Modo repo-do-OS vs. projeto derivado via
.aios-self.Dois achados na implementação: falso positivo em
./rules(contava entradas de diretório; o repo tem subpastas vazias não versionadas que o git não vê masreaddirsim), e.claude/skills/external/semSKILL.mdnem README — agora tem README declarando que é diretório de referência.P4 — Manifesto de plugin
.claude-plugin/plugin.json. Antes o OS só se distribuía por clone ou template — sem instalação versionada nem marketplace. Item aberto desde a auditoria da v0.5.P5 — Regras reequilibradas
security-baselinewizard-stage-tagsO total quase não mudou — o ponto não era cortar, era gastar onde importa. Uma convenção opt-in ocupava 25% do orçamento enquanto a regra de segurança tinha três linhas.
P6 — 75 testes, que acharam 2 bypass reais 🐛
node:test, zero dependências. E encontraram duas formas de contornar o hook de segredo que eu tinha acabado de escrever:git -C /tmp commitnão era reconhecido — o regex só tratava flags sem valor, e-Cconsome o próximo token.git add . && git committambém passava — eu retornava no primeiro segmento do shell em vez de continuar procurando.isGitCommitvirou tokenização em vez de regex. Revalidado ponta a ponta: exit 2 nos três vetores.Esta é a justificativa inteira da P6. Um hook de segurança escrito com cuidado, revisado por mim e testado à mão ainda tinha dois furos — que só apareceram quando um teste tentou quinze formas de escrever o comando.
Verificação
os-self-test: 67 verificações, zero erro, zero avisosync-selfhosted.jsreproduz o catálogo byte a byte (git diffvazio) — a refatoração para exportar funções não alterou a saídaCorreção ao meu próprio relatório
Eu tinha apontado três regras curtas como deficientes. Reexaminando: só
security-baselineera.code-styleeresearch-disciplinesão concisas mas completas — declaram limite e procedimento. Não foram infladas só para ficar consistente com o que eu havia escrito.Continua aberto
technical-plan(estágio 4.2 só com prosa)templates/project/CLAUDE.md:62anuncia/release-check, inexistente — oos-self-testainda não cruza comandos anunciados em templates com comandos reaisdeploy-vercel-supabasecobre só o Supabase gerenciadocourse/seguem divergindoSession log:
session-log/2026-08-08-v0.5.2-kernel.md🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
Security
Quality